Slashdot Mirror
Microsoft Certificate Was Used To Sign Flame Malware
wiredmikey writes "Microsoft disclosed that 'unauthorized digital certificates derived from a Microsoft Certificate Authority' were used to sign components of the recently discovered Flame malware. 'We have discovered through our analysis that some components of the malware have been signed by certificates that allow software to appear as if it was produced by Microsoft,' Microsoft Security Response Center's Jonathan Ness wrote in a blog post. Microsoft is also warning that the same techniques could be leveraged by less sophisticated attackers to conduct more widespread attacks. In response to the discovery, Microsoft released a security advisory detailing steps that organizations should take in order block software signed by the unauthorized certificates, and also released an update to automatically protect customers. Also as part of its response effort, Microsoft said its Terminal Server Licensing Service no longer issues certificates that allow code to be signed."
I kind of thought Microsoft would make damn sure someone else couldn't duplicate their signatures (barring an employee or a government doing it).
Proving once and for all that Microsoft's control of the bootloader key that is used everywhere will make all future computers more secure!
I think it was an SHS exploit or something in the Windows Kernel. Steve Gibson stepped through the Kernel and concluded that this vulnerability was an intentionally placed backdoor, perhaps by a Microsoft employee. It's in one of his earlier podcasts. Lots of people thought maybe he was crazy at the time, but in retrospect ... maybe not so much.
What exactly do you mean by "counterfeit"? If the signing key was signed by the genuine Microsoft key, how does that objectively differ from all the other signing keys?
Ezekiel 23:20
It was not a counterfeit microsoft certificate. It was a legitimate microsoft certificate from Terminal Server Licnensing Service, but used for purposes other than it was intended.
And this is how they plan to monopolize Secure Boot (UEFI) and get rid of Linux? why should I trust that ONE KEY that microsoft plans to install on all motherboards?
JP
Oops... typo... Counterfeiting! =copying.
The certs issues from the Terminal Server Licensing Service were intended to be used only for connections and not code signing. This is Microsoft's blunder. They weren't actually licensing malicious certificates but they were giving people tools to issue what appeared to be valid certs coming from MS.
The fixes are going to be changing TSLS so that its certs can no longer be used to sign code and revoking the intermediate CA certs that are affected.
http://blogs.technet.com/b/msrc/archive/2012/06/03/microsoft-releases-security-advisory-2718704.aspx
I wonder how long will it take for the government(s) to decide they in fact own every computer (or at least it's processing capabilities) and issue some sort of mandatory backdoor. As it seems antivirus companies might be first compelled to "go along" with the new paradigm, by probably "not detecting" presence of some (government?!) software (that we oldfashionedly still call "malware", whereas these pieces of code are highly focused towards very specific target, so majority of users/comp. owners should have no problems whatsoever with the sinister part of said software). Indeed, grim future may even be "you should let that piece of software alone, if you have nothing to hide". Weather or not this story has anything to do with the _NSAKEY.
Considering that microsoft sold the possibility to sign ssl certificates for any domain to the late Tunisian government, why wouldn't they sell the same thing to the makers of that virus, if it really comes from a government?
source: http://arabcrunch.com/2011/09/wikileaks-microsoft-accused-in-helping-bin-ali-monitor-tunisians-corruption-stifling-open-source.html
Flamer is out in the wild since cca. 2007, with a MS signed certificate, and the only IT security organization that decides to bring it to public attention is a Russian company, and the first removal tool is from a Romanian company. Isn't this a bit strange? Isn't it more likely that this NA-designed spyware targetting the Middle East was released with the tacit agreement of Western security companies and it only became known because the Russians, for some reason, decided they would not play the game? Microsoft being unaware for thw last few years that hundreds of computers are infected with a 20 MB spyware pack bearing a security certifice of their own? Come on...
So... what did we learn today?
1. Signed code is not safe code.
2. An insecure operating system that only runs signed code is still an insecure operating system.
"In prison you just have to shut your eyes and take it. Here you have to shut your eyes and give it."
Yes, registering with MS for $99 (which goes entirely to Verisign) is an insurmountable problem.
If each end user has to do it, then yes, it is insurmountable in practice. It's especially hard for people who disagree with the principles of Norton software, which is sold by the same company that bought Verisign's certificate business.
Why are there two certificates with the exact same label? It takes a special kind of idiot.
"Microsoft Enforced Licensing Intermediate PCA"
Why does a certificate valid from 2002 to 2010 matter in 2012.. oh yea thats right code signing certificates are based on the timestamp of the code and so when you compromise a signing cert 100 years from now and take that impossibly difficult extra step of forging a valid timestamp it will still be valid. All code signing certs should have an indefinate expiration because effectivly thats what they really are. Any other label is grossly misleading.
The security week and MS article talks about forging keys using what I assume are insecure for signature algorithms.. I assume they mean MD5..but hey look at this:
The signature algorithm for Microsoft Enforced Licensing Registration Authority CA (SHA1) is sha1 this is currently what EVERYONE is using. Was this cert also compromised in the same way? Why is it here?
And that purpose was Plausible Deniability.